hydra | 1101d16bdbd021d03cec94ac05abce0498ea5766923ac060caf6fa5d95ba98ca | Triage

Resubmissions

15/08/2021, 20:09

210815-9anc9h6lvj 10

15/08/2021, 20:00

210815-k3rd5y7kgn 10

Analysis

max time kernel
1265152s
max time network
40s
platform
android_x64
resource
android-x64
submitted
15/08/2021, 20:00

Sharing

Report Analysis Logs

General

Target

91648_Video_Oynatıcı.apk
Size

3.0MB
MD5

f754fdb148454e2aaeac021374e7cd03
SHA1

5eaaca3b46cc0b7027c8cf5cb30be9d270315da3
SHA256

1101d16bdbd021d03cec94ac05abce0498ea5766923ac060caf6fa5d95ba98ca
SHA512

ad8579d62005d129e5428e080f75799ab82ebe0e191648a2607c04d4649e5b48770a29f49611a2745e9b24419e1d3c34de7cb381976bdc9593014256c19a3412

Score

10^/10

hydra banker infostealer obfuscation trojan

Malware Config

Extracted

Family

hydra

C2

http://danylmassey574.xyz

Signatures

Hydra
Android banker and info stealer.
banker trojan infostealer hydra

Loads dropped Dex/Jar 1 IoCs

Runs executable file dropped to the device during analysis.

ioc	pid	Process
/data/user/0/com.mnjgllsx.thwzxxs/code_cache/secondary-dexes/base.apk.classes1.zip	3616	com.mnjgllsx.thwzxxs

Uses reflection 3 IoCs

description	pid	Process
Acesses field com.android.okhttp.internal.tls.OkHostnameVerifier.INSTANCE	3616	com.mnjgllsx.thwzxxs
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	3616	com.mnjgllsx.thwzxxs
Acesses field javax.security.auth.x500.X500Principal.thisX500Name	3616	com.mnjgllsx.thwzxxs

com.mnjgllsx.thwzxxs
1⤵
- Loads dropped Dex/Jar
- Uses reflection
PID:3616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads